# How to get VAULT\_TOKEN in Nomad job?

**URL:** <https://discuss.hashicorp.com/t/how-to-get-vault-token-in-nomad-job/66331>\
**Category:** Nomad\
**Tags:** vault, consul-vault, consul\
**Created:** [April 24, 2024, 10:27am UTC](https://discuss.hashicorp.com/t/how-to-get-vault-token-in-nomad-job/66331 "2024-04-24T10:27:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kamilcuk](https://avatars.discourse-cdn.com/v4/letter/k/f08c70/32.png) [@Kamilcuk](https://discuss.hashicorp.com/u/Kamilcuk)\
**Post date:** [April 24, 2024, 10:27am UTC](https://discuss.hashicorp.com/t/how-to-get-vault-token-in-nomad-job/66331/1 "2024-04-24T10:27:16Z")

</div>

I am using “legacy” Nomad vault integration for quite some time. The `vault { policies = ["mypolicy"] }` exports a `VAULT_TOKEN` for my job in Nomad, and allows using `template {{ key }}` templates.

I read [vault Block - Job Specification | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/job-specification/vault) , [vault Block - Agent Configuration | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/configuration/vault) , [Workload Identity | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/concepts/workload-identity#workload-identity-for-nomad) , [Vault Integration | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/integrations/vault) and the main [Vault ACL | Nomad | HashiCorp Developer](https://docs.hashicorp.com/nomad/docs/integrations/vault/acl) . The tutorial [Vault integration and retrieving dynamic secrets | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/tutorials/integrate-vault/vault-postgres#configure-nomad) uses the “legacy way” of vault integration that I currently also use.

After reading and researching, I have no idea what is going on, thus this post.

“Workload identity” is some JSON with some data. _Why_ (as a user of Nomad and Vault) do I have to know what is “workload identity”? Why would “workload identity” be ever used by a task with `NOMAD_TOKEN_vault `?

The page [Workload Identity | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/concepts/workload-identity#workload-identity-for-consul-and-vault) redirects to [Vault Integration | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/integrations/vault?page=integrations&page=vault-integration) page which only mentions how to use vault for templates configuration, not how to get VAULT\_TOKEN into the job. How do I make “identity vault” Nomad job specification that will generate a VAULT\_TOKEN for my job with specific permission?

The migration guide [Vault ACL | Nomad | HashiCorp Developer](https://docs.hashicorp.com/nomad/docs/integrations/vault/acl#migrating-to-using-workload-identity-with-vault) states that I `can specify this identity directly in the job or redeploy the job without changes`. However, I am not able to do that, becuase I am getting the error: `Task .... has a Vault block with policies but uses workload identity to authenticate with Vault, policies will be ignored`. Is the migration guide incomplete? What will be the “default”(?) permission of a vault token with ignored policies with identity?

What is “[vault.io](http://vault.io)” in “aud” field in [vault Block - Agent Configuration | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/configuration/vault) configuration? Similarly, what is “[consul.io](http://consul.io)” in consul identity? Are these hardcoded values or should be replaced with some real values? What does the “io” refer to? Why do I care about this field? Should I replace “aud” field with DNS-resolvable name to the Vault service, like `vault.service.consul.my.domain.com`? If so, what about port?

If there is default\_identity in vault{} block in Nomad configuration, why is there no default cluster name in the default\_identity? Should I write `idenity { name = "vault_default" }` in every job?

Is the configuration in [identity Block - Job Specification | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/job-specification/identity#workload-identities-for-vault) enough to move from “legacy vault integration” to the workload identity? Will the configuration in the link export VAULT\_TOKEN with what permissions for my job?

Finally, after integration with vault identities, will Nomad server be able to start _without_ vault running? Can I run vault as a Nomad service?

Thank you.